Cups EUVD-2026-18884

CVSS v3.1 base score of 6.5 (Medium severity) reflects an unauthenticated network attack vector with low complexity, no privilege requirement, no scope change, and both integrity and availability impacts. The EPSS score is not provided, but the practical real-world risk is elevated beyond the CVSS rating for several reasons: (1) the attack requires no authentication or user interaction, making it trivially accessible to any network-connected attacker; (2) the default CUPS configuration (group-writable CacheDir) ensures the vulnerability is exploitable on most installations without special hardening; (3) the integrity impact (arbitrary file write) combined with availability impact (scheduler failure and job loss) creates significant operational disruption; (4) the underlying IPP protocol is often exposed on internal networks, increasing exposure. However, the attack does not achieve remote code execution and does not provide attacker persistence. SSVC analysis: exploitation is unassessed but the low-complexity network attack vector and default-configuration exploitability suggest the attack is likely automatable. The technical impact is moderate (localized availability loss, file overwrite capability). Organizational impact depends on printing criticality. This is a legitimate priority vulnerability for any organization running CUPS on networked systems, particularly those where print job continuity is important.

An attacker on the same network as a CUPS server (or with network access to the IPP port) submits a print job via IPP with a malicious notify-recipient-uri value such as 'rss:///../job.cache'. The RSS notifier parses this parameter without proper path validation, escapes the rss subdirectory via '../' traversal, and writes RSS XML content to the parent CacheDir, overwriting the job.cache file. Upon the next CUPS daemon restart (scheduled or triggered by the attacker if possible), the scheduler attempts to parse the corrupted job.cache, fails validation, and discards all queued print jobs. The attacker achieves availability denial without authentication or code execution. Proof-of-concept code demonstrating this attack is described in the vulnerability report, though no standalone exploit is currently public.